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ABSTRACT 


The  Secretary  of  the  U.S.  Department  of  Homeland  Security  (DHS)  stated  “Ensuring 
America's  small  businesses  have  the  critical  information  and  training  they  need  to  better  respond 
to  disasters  will  strengthen  the  entire  nation's  preparedness  and  resilience.”  To  address  this  need 
DHS  created  the  Voluntary  Private  Sector  Preparedness  Accreditation  and  Certification  Program 
(PS-Prep)(Napolitano,  2010).  PS-Prep  is  designed  to  provide  business  continuity  guidelines  to 
small  business  owners.  The  program  does  little  to  provide  shared  awareness  across  that 
community.  This  research  utilizes  the  PS-Prep,  and  the  established  framework  of  a  Business 
Emergency  Operations  Center  (BEOC)  to  establish  a  model  for  a  Virtual  Small  Business 
Emergency  Operations  Center  (VSBEOC)  (New  Jersey  Institute  of  Technology,  2009)  (New 
Jersey  Business  Force,  2010).  The  VSBEOC  will  provide  the  small  business  community  with 
access  to  a  collaborative  environment  where  critical  infonnation  can  be  shared  and  processed 
thereby  improving  the  community’s  situational  awareness  and  enabling  a  more  efficient  and 
effective  recovery  from  business  interruption. 

Keywords 

Emergency  Operations  Center  (EOC),  Business  Emergency  Operations  Center  (BEOC), 

Business  Continuity,  Incident  Command 

INTRODUCTION 

Business  continuity  planning  is  a  significant  growth  area  for  the  emergency  management 
community  (Haddow,  2008).  The  devastating  impacts  of  September  1 1  resulted  in  increased 
coordination  and  cooperation  between  business  and  emergency  managers  (Haddow,  2008). 
Today,  business  continuity  in  the  private  sector  is  synonymous  with  emergency  preparedness  in 
the  public  sector.  Both  public  and  private  sectors  are  preparing  to  respond  to  and  recover  from  a 
possible  future  disaster.  Private  sector  organizations  would  seek  to  recover  in  order  to  begin 
making  money  again  while  public  sector  organizations  would  seek  to  restore  critical 
infrastructure  in  order  to  provide  security  and  restore  critical  infrastructure  for  their 
communities. 

In  the  public  sector,  size  matters.  Small  towns  and  villages  rely  heavily  on  mutual 
assistance  from  adjacent  communities  as  well  as  county  and  state  resources.  Larger  towns  and 
cities  are  able  to  provide  for  the  majority  of  their  own  emergency  response.  Similarly  small 
businesses  rely  heavily  on  the  public  sector  for  emergency  response  and  large  private 
organizations  have  become  self  reliant  in  their  abilities  to  respond  to  even  complex  disruptions 
and  disasters.  Unlike  the  public  sector  where  small  towns  and  villages  rely  on  neighboring  larger 
towns  and  cities  for  assistance,  large  private  sector  organizations  do  not  provide  assistance  to 
their  neighboring  small  organizations. 

In  October  of  2007  the  Federal  Emergency  Management  Agency  (FEMA)  established  a 
Private  Sector  Division  with  the  purpose  of  cultivating  and  advocating  for  collaboration  between 
the  U.S.  private  sector  and  FEMA,  to  support  FEMA’s  capabilities  and  to  enhance  national 
preparedness,  protection,  response,  recovery,  and  mitigation  of  all  hazards  (FEMA  PSD,  2011). 
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In  2010  Department  of  Homeland  Security  (DHS)  Janet  Napolitano  made  two  key 
announcements  of  programs  designed  specifically  for  small  business: 

1.  June  15,  2010  -  Voluntary  Private  Sector  Preparedness  Accreditation  and 
Certification  Program  (PS-Prep)  Resource  Center  (FEMA  PSD,  2011). 

2.  September  30,  2010  -  a  key  milestone  in  the  Department’s  efforts  to  develop  a 
robust  small  business  preparedness  plan  -  soliciting  public  comment  on  a  private 
sector  readiness  certification  program  specifically  tailored  to  the  needs  of  small 
businesses  (Napolitano,  2010). 

New  Jersey  Institute  of  Technology  (NJIT)  developed,  implemented  and  continues  to 
improve  a  Business  Emergency  Operations  Center  (New  Jersey  Institute  of  Technology).  The 
BEOC  is  a  Private  sector  organized,  managed,  and  staffed  emergency  coordination/operations 
center  focused  on  all-hazards  disaster  prevention,  preparation,  response,  and  recovery  (New 
Jersey  Institute  of  Technology,  2009).  The  BEOC  has  proven  to  be  a  valuable  collaborative 
environment  where  business  members  build  a  shared  awareness  of  current  incidents  and  an 
increased  situational  awareness  during  disaters.  Currently  the  BEOC  does  not  have  any  small 
business  orgaizations  as  members. 

This  research  will  build  on  the  current  research  which  evaluated  the  applicability  of  PS- 
Prep  to  adequately  address  the  needs  of  small  businesses  (Bell,  2011).  It  will  also  build  upon  the 
successes  of  the  BEOC  and  leverage  current  BEOC  technology  to  bring  the  same  successes  to 
the  small  business  community  (New  Jersey  Business  Force,  2010).  The  VSBEOC  will  provide 
small  businesses  with  better  shared  awareness  through  alerts  and  notifications.  It  will  also 
provide  the  resources  necessary  to  build,  maintain,  and  access  reliable  business  continuity  plans 
in  order  to  properly  respond  to  business  outages. 

PS-Prep 

Private  sector  organizations  that  do  not  rise  to  the  current  complex  challenges  of  business 
continuity  management  are  at  risk  of  disruptions  and  failures  that  may  significantly  affect  their 
ability  to  stay  in  business  (Davis,  n.d.).  This  statement  is  true  but  it  is  also  misleading.  It  is 
misleading  because  it  implies  that  every  private  sector  organization  has  the  means  to  rise  to  the 
complex  challenges  of  business  continuity  management.  Small  businesses  in  general  do  not 
possess  the  means  to  appropriately  prepare  for  the  response  and  recovery  from  a  complex  event. 
Small  businesses  do  not  have  the  staffing,  financing,  or  the  infrastructure  to  meet  the  current 
complex  business  continuity  challenges. 

“Ensuring  America's  small  businesses  have  the  critical  infonnation  and  training  they  need 
to  better  respond  to  disasters  will  strengthen  the  entire  nation's  preparedness  and  resilience 
(Napolitano).”  PS-Prep,  specifically  ASIS  SPC.  1-2009,  was  evaluated  to  determine  its 
applicability  to  adequately  address  the  needs  of  small  business  owners  (ASIS,  2009)  (Bell, 

2011).  In  short,  PS-Prep  fails  to  address  many  of  the  needs  of  the  small  business  community. 
Below  is  a  list  of  statements  from  PS-Prep  which  are  not  applicable  to  small  businesses: 
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1. 

2. 

3. 


4. 


Organizations  should  identify  and  establish  relationships  with  public  sector 
agencies. . .  Arrangements  should  be  made  for  communication  and  warnings 
internally  and  externally  for  normal  and  abnormal  conditions  (PS-Prep,  2010). 
Public  Sector  organizations  required  to  respond  to  emergencies  do  not  have  the 
time  or  the  resources  to  collaborate  on  a  continual  basis  with  a  large  number  of 
organizations. 

A  primary  Crisis  Management  Center  (CMC)  should  be  identified  in  advance. 
This  is  the  initial  site  used  by  the  Crisis  Management  Team  and  Response  Teams 
for  directing  and  overseeing  crisis  management  activities  (PS-Prep,  2010).  How 
many  small  businesses  have  the  staffing  and  the  budget  to  implement  a  primary 
Crisis  Management  Center?  How  many  have  the  resources  to  have  a  secondary 
CMC?  Ps-Prep  also  states  that  all  emergency  response  personnel  should  perform 
crisis  management  duties  as  part  of  their  normal  work  duties.  How  many  small 
businesses  have  the  budget  to  pay  personnel  during  a  time  when  they  are  not 
making  any  money? 

Testing  the  Business  Continuity  Plan.  Many  small  businesses  can’t  shut  down 
their  operations  to  perform  valid  tests  of  their  response  plans.  Remember, 
emergency  plans  are  tested  on  a  continuous  cycle  as  depicted  in  the  FEMA 
Preparedness  cycle  (FEMA  2011)  see  Figure  1. 
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Fig.  1  FEMA  Preparedness  Cycle 


5.  There  are  a  number  of  other  areas  of  this  plan,  monitoring  and  measurement, 
evaluation  and  compliance,  audits,  and  management  review  that  inhibit  its 
applicability  to  small  businesses. 


The  ASIS  SPC.  1-2009  document  is  the  primary  document  of  the  PS-Prep  program.  The 
program  was  developed  and  distributed  by  FEMA  and  yet  it  is  not  compatible  with  the  National 
Incident  Management  System  (NIMS)  and  therefore  not  compatible  with  the  Incident  Command 
System  (ICS)  (ASIS,  2009)  (US  DHS,  2008).  These  systems  NIMS  and  ICS  are  the  national 
standards  for  emergency  management  as  directed  by  a  Presidential  Directive  (HSPD-5  2003). 
PS-Prep  chooses  to  provide  compatibility  with  the  International  Organization  for  Standardization 
(ISO)  (ASIS  Appendix  B).  Ps-Prep  also  uses  common  terminology  aligned  with  ISO  rather  than 
with  the  ICS.  The  ICS  was  first  developed  in  the  1970’s  to,  in-part  bring  common  terminology 
to  emergency  responders  in  multi-agency  multi-jurisdictional  incidents  (FIRESCOPE,  1988). 
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Failure  of  PS-Prep  to  provide  NIMS  and  ICS  compatibility  severely  inhibits  the  entire  private 
sector  business  community  from  achieving  the  shared  awareness  that  the  program  was  designed 
to  deliver. 

Business  Emergency  Operations  Center  (BEOC) 

The  PS-Prep  document  ASIS  SPC.  1-2009  (2009,  34),  states  that  the  organization  should 
consider  the  establishment  of  virtual  command  centers  for  distributed  access  to  infonnation  as 
well  as  to  reach  dispersed  or  remote  stakeholders.  This  single  element  of  PS-Prep  provides  the 
most  valuable  infonnation  for  small  businesses.  It  provides  the  link  to  a  BEOC  where  small 
businesses  can  achieve  the  shared  awareness  that  larger  private  sector  organizations  already 
have. 


The  BEOC  operatites  a  versatile  communication  hub  which  links  the  public  and  private 
sectors  in  omni-directional  information  sharing  (New  Jersey  Business  Force).  BEOC 
development  is  consistent  with  the  basic  guidance  provided  by  President  Bush’s  October  2007 
National  Strategy  for  Infonnation  Sharing  as  well  as  the  January  2008  National  Response 
Framework  (FEMA  NRF)  (U.S.  Whitehouse).  The  BEOC  has  served  as  the  EOC  during  several 
national  and  local  drills  and  simulations  as  well  as  during  actual  events. 

The  aftennath  of  September  1 1  has  prompted  many  organizations  to  delevop  Virtual 
Emergency  Operation  Centers  (VEOC).  An  EOC  is  virtual  when  participants  can  share 
information,  make  decisions  and  deploy  resources  without  being  physically  present  in  the  EOC 
(S.  C.  Davis).  In  Turoff  s  DERMIS  paper  the  authors  write  that  crises  involve  the  necessity  for 
many  hundreds  of  individuals  from  different  organizations  to  be  able  to  freely  exchange 
information,  delegate  authority,  and  conduct  oversight,  without  the  side  effect  of  infonnation 
overload  (Turoff).  Hundreds  or  thousands  of  small  businesses  attempting  to  contact  any 
emergency  response  agency,  as  directed  in  PS-Prep,  will  likely  prevent  those  agencies  from 
effectively  communicating  with  responders  and  victims  alike.  Small  business  owners  who  must 
gather  all  their  information  from  news  media  will  likely  become  overloaded  with  information 
that  will  not  be  useful  to  their  response  efforts. 

The  VSBEOC  will  operate  with  a  secure  portal  designed  around  the  capabilities  of  the 
current  BEOC  secure  portal.  New  Jersey  Institute  of  Technology  has  the  ability  to  build  a 
distinct  secure  portal  for  small  businesses.  This  portal  will  also  have  the  capability  to  share 
information  across  portals  with  the  NJ  Business  Force.  This  will  allow  the  VSBEOC  to  begin 
operation  with  the  capability  of  delivering  alerts  and  notifications  to  all  member  small 
businesses.  As  the  number  of  small  business  members  increase  so  will  the  value  of  the 
information  and  intelligence  that  the  VSBEOC  will  be  able  to  share  internally  and  across  portals. 

As  previously  written  the  PS-Prep  program  fails  small  businesses  in  several  areas.  The 
VSBEOC  has  the  technology  to  deliver  some  of  the  services  that  will  assist  small  business 
owners  to  a  more  robust  business  continuity  plan.  There  is  a  real  effort  between  public  and 
private  sector  organizations  to  share  information.  The  BEOC  is  currently  working  with  several 
public  sector  EOC’s  and  the  state  EOC.  The  effort  is  succeeding  at  least  in  part  because  the 
public  centers  are  sharing  infonnation  with  a  single  entity  who  intum  is  the  conduit  for  sharing 
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information  with  both  its  members  and  the  public  centers.  Public  EOC’s  do  not  have  the  staffing 
to  provide  similar  services  to  every  organization  that  desires  to  share  infonnation. 

PS-Prep  also  calls  for  a  primary  and  secondary  Crisis  Management  Center  (CMC).  The 
VSBEOC  will  unify  the  small  business  community  and  provide  a  virtual  CMC.  Small  business 
will  be  able  to  access  their  businees  continuity  plans,  collaborate  with  each  other  to  provide  the 
most  cost  effective  response,  and  maintain  up  to  date  infonnation  about  their  communities 
response  efforts.  The  VSBEOC  will  provide  the  small  business  community  with  the  necessary 
tools  better  prepare  them  to  respond  to  events  causing  business  outages. 

Testing  the  business  continuity  plan  is  a  difficult  process  for  the  small  business  owner  to 
accomplish.  The  VSBEOC  will  be  able  to  coordinate  plan  testing  so  that  lessons  learned  from 
similar  organizations  can  be  provided  across  the  portal  so  many  small  businesses  can  benefit 
from  a  single  test.  The  VSBEOC  can  also  leverage  lessons  learned  from  NJIT’s  simulation  test 
bed  and  simulation  lab.  This  information  can  be  presented  within  the  secure  portal  as  a 
conference,  discussion,  or  as  shared  infonnation. 

Compliance,  monitoring  and  measuring  are  also  areas  where  the  PS-Prep  details  several 
levels  of  audits  which  small  business  owners  can  not  complete.  The  VSBEOC  will  assist  small 
business  owners  with  completion  of  business  continuity  (BC)  plans  which  the  owners  feel  are 
compatible  with  their  capabilities.  Documents  and  records  will  be  stored  and  accessed  through 
the  secure  VSBEOC  portal.  Records  which  need  updating  can  automatically  generate  alerts  to 
the  owners  to  notify  them.  Document  storage  can  also  be  a  part  of  the  secure  portal  so  that 
owners  can  safeguard  important  documents. 

Conclusion: 

FEMA  attempted  to  assist  the  small  business  community  by  implementing  a  certification 
program  compatible  with  ISO  standards.  PS-Prep  contains  three  documents,  ASIS  SPC.  1-2009, 
BS-25999,  and  the  Standard  on  Disaster/Emergency  and  Business  Continuity  by  the  National 
Fire  Protection  Agency  (ASIS,  2009)  (DHS,  2010)  (NFPA,  2007)  (Avalution  Consulting  and 
BSI  Management  Systems  America,  2008).  Each  document  seeks  to  certify  the  participating 
organization  with  initial  fees  and  additional  fees  coresponding  to  continuing  requirements. 

Many  large  corporations  refuse  to  become  ISO  certified  because  the  cost  of  certification  is  not 
within  their  opeating  budget.  Small  business  owners  need  assistance  in  developing  business 
coninuity  plans  but  can  not  afford  to  pay  for  services  that  fail  to  provide  the  framework  and 
resources  that  are  needed. 

PS-Prep  also  failed  to  unify  the  private  sector  business  community  with  the  NIMS  and 
ICS  standards.  By  providing  compatibility  with  ISO  instead  of  ICS,  PS-Prep  placed  the  private 
sector  at  a  disadvantage  in  establishing  a  collaborative  environment  with  the  public  sector.  This 
disadvantage  can  only  be  universally  overcome  through  FEMA’s  redistribution  of  this  program 
with  ICS  compatibility.  THE  VSBEOC  can  overcome  this  disadvantage  locally  by  providing  a 
training  course  on  the  NC4  secure  portal.  The  training  will  be  shared  across  portals  with  all 
member  organizations. 
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The  VSBEOC  will  set  the  standard  for  creating  the  collaborative  environment  needed  to 
establish  shared  awareness  throughout  the  small  business  community.  Small  businesses  will  no 
longer  have  to  rely  solely  their  own  limited  resources.  Resources  can  be  shared  across  the 
community  creating  a  more  efficient  and  cost  effective  approach  to  incident  response  and  BC. 
Secure  document  storage  and  retrieval  including  business  continuity  plans  will  be  available  to  all 
members.  The  VSBEOC  was  developed  with  technology  leveraged  from  the  existing  BEOC  but 
the  requirements  of  the  small  business  community  will  be  such  that  the  VSBEOC  will  become 
more  robust  than  the  BEOC. 
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Business  Continuity 

BC-Private  Sector  Emergency  Preparedness 


Size  Matters  -  Public  &  Private 

2007  -  FEMA  Establishes  Private  Sector 
Division 

2010  -  BC  Certification  Established 


DHS  -  PS-Prep 
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ASIS  SPC. 1-2009 
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Establish  Primary  Crisis  Management  Center 
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Conclusion 
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